Cyberattacks Threaten U.S. Water Systems Across Multiple States

Cyberattacks on municipal water systems have been reported in at least seven U.S. states, prompting a response from the FBI and the Environmental Protection Agency (EPA). These agencies warned utilities nationwide about hackers attempting to disrupt critical water infrastructure.

A public service announcement issued last Thursday stated that water and wastewater utilities have alerted the FBI about incidents where malicious activities degraded water operations. Although the announcement did not specify the affected states, over 30 municipal water facilities in Minnesota were targeted in an attack suspected to have involved Iranian actors, according to a law enforcement official. This incident is under investigation.

Despite the breaches, a Minnesota information technology services agency spokesperson assured that there were no indications of contaminated water supplies. The federal advisory identified that malicious cyber actors targeted specific control systems used by municipal water utilities. The FBI and EPA advised all operators to take preventive measures.

This warning underscores the vulnerability of U.S. infrastructure to foreign interference. Currently, tensions are high with ongoing military conflicts involving Iran, affecting U.S. ties with the region. In Minnesota, hackers accessed internet-facing devices, altered IP addresses and passwords, and disrupted monitoring and control operations.

The federal advisory recommends that water system operators implement protective measures such as:

• Removing programmable logical controllers (PLCs) from direct internet exposure.
• Securing systems with gateways and firewalls.
• Using strong passwords.
• Restricting communication between authorized control system devices through access control lists.

Federal and state officials have not attributed the breaches to any specific group. Emily Zimmer from Minnesota’s information technology agency emphasized the need for thorough analysis of technical evidence in collaboration with national and international intelligence.

The incident in Minnesota occurred shortly after U.S. officials cautioned against Iran-backed hackers targeting vital national infrastructure amid rising tensions with Tehran. A public advisory released on July 22 by the Cybersecurity and Infrastructure Security Agency and the FBI urged companies to ramp up defenses against Tehran-linked intrusions.

U.S. intelligence agencies point out that Iran has intensified aggressive cyber operations, including targeting water systems in 2023. Two years prior, the EPA noted an increase in cyberattacks on water utilities nationwide, revealing that about 70% of utilities inspected violated preventive standards.